Apache Web Server Hardening & Security

Guide
Secure Apache Web Server Practical Guide
1

Introduction

The Web Server is a crucial part of web-based applications. Apache Web Server is often placed at the edge
of the network hence it becomes one of the most vulnerable services to attack. Having default
conguration supply many sensitive information which may help hacker to prepare for an attack the web
server.
The majority of web application attacks are through XSS, Info Leakage, Session Management and PHP
Injection attacks which is due to weak programming code and failure to sanitize web application
infrastructure. According to the security vendor Cenzic, 96% of tested applications have vulnerabilities.
Below chart from Cenzic shows the vulnerability trend report of 2013.

This practical guide provides you the necessary skill set to secure Apache Web Server. In this course, we
will talk about how to Harden & Secure Apache Web Server on Unix platform. Following are tested on
Apache 2.4.x and I dont see any reason it wont work with Apache 2.2.x.

2. This assumes you have installed Apache on UNIX platform. If not, you can go through Installation guide.
You can also refer very free video about how to Install Apache, MySQL & PHP.
4. We will call Apache installation directory /opt/apache as $Web_Server throughout this course.
6. You are advised to take a backup of existing conguration le before any modication.

1.1 Audience
This is designed for Middleware Administrator, Application Support, System Analyst, or anyone working or
eager to learn Hardening & Security guidelines. Fair knowledge of Apache Web Server & UNIX command is
mandatory. This is seven page guide, click on Next to proceed. You may navigate through table of
contents at right hand side.

Information Leakage

In default Apache conguration you would have many sensitive information disclosure, which can be used
to prepare for an attack. Its one of the most critical tasks for administrator to understand and secure
them. As per report by Cenzic, 16% of vulnerability is found in Info leakage. We require some tool to
examine HTTP Headers for verication. Lets do this by install rebug add-on in Firefox.
Open Firefox
Access https://addons.mozilla.org/en-US/refox/addon/rebug/
Click on Add to Firefox

Click on Install Now

Restart Firefox
You can see rebug icon at right top bar

We will use this icon to open rebug console to view HTTP Headers information. There are many online
tools also available which helps to check in HTTP header information. Below are some of them you can try
out. http://tools.geekare.com/seo/tool.php?id=check-headers

2.1 Remove Server Version Banner

I would say this is one of the rst things to consider, as you dont want to expose what web server version
you are using. Exposing version means you are helping hacker to speedy the reconnaissance process.
Default conguration will expose Apache Version and OS type as shown below.
Implementation:
Go to $Web_Server/conf folder
Modify httpd.conf by using vi editor
Add following directive and save the httpd.conf
ServerTokens Prod
ServerSignature Off
Restart apache
ServerSignature will remove the version information from the page generated like 403, 404, 502, etc. by
apache web server. ServerTokens will change Header to production only, i.e. Apache
Verication:
Open Firefox
Activate rebug by clicking rebug icon at top right side
Click on Net tab

Hit the URL in address bar

Expand the GET request and you could see Server directive is just showing Apache, which is much
better than exposing version and OS type.

2.2 Disable directory browser listing

Disable directory listing in browser so visitor doesnt see what all le and folders you have under root or
sub-directory. Lets test how does it look like in default settings.
Go to $Web_Server/htdocs directory
Create a folder and few les inside that
# mkdir test
# touch hi
# touch hello
Now, lets try to access Apache by http://localhost/test

As you could see it reveals what all le/folders you have

which is certainly you dont want to expose.
Implementation:
Go to $Web_Server/conf directory
Open httpd.conf using vi
Search for Directory and change Options directive to None or Indexes
<Directory /opt/apache/htdocs>
Options None

Order allow,deny
Allow from all
</Directory>
(or)
<Directory /opt/apache/htdocs>
Options -Indexes
Order allow,deny
Allow from all
</Directory>
Restart Apache
Note: if you have multiple Directory directives in your environment, you should consider doing the same
for all.
Verication:
Now, lets try to access Apache by http://localhost/test

As you could
see, it displays forbidden error instead showing test folder listing.

2.3 Etag
It allows remote attackers to obtain sensitive information like inode number, multipart MIME boundary and
child process through Etag header. To prevent this vulnerability, lets implement it as below. This is
required to x for PCI compliance.
Implementation:
Go to $Web_Server/conf directory
Add following directive and save the httpd.conf
FileETag None
Restart apache

Verication:
Open Firefox and access your application
Check HTTP response headers in rebug, you should not see Etag at all.

Authorization

3.1 Run Apache from non-privileged account

Default apache conguration is to run as nobody or daemon. Its good to use a separate non-privileged
user for Apache. The idea here is to protect other services running in case of any security hole.
Implementation:
Create a user and group called apache
#groupadd apache
# useradd G apache apache
Change apache installation directory ownership to newly created non-privileged user
# chown R apache:apache /opt/apache
Go to $Web_Server/conf
Modify httpd.conf using vi
Search for User & Group Directive and change as non-privileged account apache
User apache
Group apache

Save the httpd.conf

Restart Apache
Verication:
grep for running http process and ensure its running with apache user
# ps ef |grep http

Note: You could see one process is running with root. Thats because Apache is listening on port 80 and it
has to be started with root. We will talk about how to change port number later in this course.

3.2 Protect binary and conguration directory permission

By default, permission for binary and conguration is 755 that mean any user on server can view the
conguration. You can disallow other user to get into conf and bin folder.
Implementation:
Go to $Web_Server directory
Change permission of bin and conf folder
# chown R 750 bin conf

Verication:

3.3 System Settings Protection

In default installation, users can override apache conguration using .htaccess. if you want to stop users
changing your apache server settings, you can add AllowOverride to None as shown below. This must be
done at root level.
Implementation:
Go to $Web_Server/conf directory
Open httpd.conf using vi
Search for Directory at root level

<Directory />
Options -Indexes
AllowOverride None
</Directory>
Save the httpd.conf
Restart Apache

3.4 HTTP Request Methods

HTTP 1.1 protocol support many request methods which may not be required and some of them are having
potential risk. Typically you may just need GET, HEAD, POST request methods in web application, which
can be congured in respective Directory directive. Default apache conguration support OPTIONS, GET,
HEAD, POST, PUT, DELETE, TRACE, CONNECT method in HTTP 1.1 protocol.
Implementation:
Go to $Web_Server/conf directory
Open httpd.conf using vi
Search for Directory and add following
<LimitExcept GET POST HEAD>
deny from all
</LimitExcept>

Web Application Security

Apache web server misconguration or not hardened properly can exploit web application. Its critical to
harden your web server conguration.

4.1 Cookies
4.1.1

Disable Trace HTTP Request

By default Trace method is enabled in Apache web server. Having this enabled can allow Cross Site
Tracing attack and potentially giving an option to hacker to steal cookie information. Lets see how it looks
like in default conguration.
Do a telnet web server IP with listen port
Make a TRACE request as shown below
#telnet localhost 80

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
TRACE / HTTP/1.1 Host: test
HTTP/1.1 200 OK
Date: Sat, 31 Aug 2013 02:13:24 GMT
Server: Apache
Transfer-Encoding: chunked
Content-Type: message/http 20
TRACE / HTTP/1.1
Host: test 0
Connection closed by foreign host.
#
As you could see in above TRACE request it has responded my query. Lets disable it and test it.
Implementation:
Go to $Web_Server/conf directory
Add following directive and save the httpd.conf
TraceEnable off
Restart apache
Verication:
Do a telnet web server IP with listen port and make a TRACE request as shown below
#telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
TRACE / HTTP/1.1 Host: test
HTTP/1.1 405 Method Not Allowed
Date: Sat, 31 Aug 2013 02:18:27 GMT
Server: Apache Allow:
Content-Length: 223
Content-Type: text/html; charset=iso-8859-1 <!DOCTYPE HTML PUBLIC "//IETF//DTD HTML 2.0//EN"> <html><head> <title>405 Method Not Allowed</title>
</head><body> <h1>Method Not Allowed</h1>
<p>The requested method TRACE is not allowed for the URL /.</p> </body></html>
Connection closed by foreign host.
#
As you could see in above TRACE request it has blocked my request with HTTP 405 Method Not Allowed.
Now, this web server doesnt allow TRACE request and help in blocking Cross Site Tracing attack.

4.1.2

Set cookie with HttpOnly and Secure ag

You can mitigate most of the common Cross Site Scripting attack using HttpOnly and Secure ag in cookie.
Without having HttpOnly and Secure, it is possible to steal or manipulate web application session and
cookies and its dangerous.
Implementation:
Ensure mod_headers.so is enabled in your httpd.conf
Go to $Web_Server/conf directory
Add following directive and save the httpd.conf
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Restart apache
Verication:
Open Firefox and access your application
Check HTTP response headers in rebug, you should see Set-Cookie is agged with HttpOnly and
Secure as shown below.

4.2 Clickjacking Attack

Clickjacking is well known web application vulnerabilities. You can refer my previous post Secure Your Web
Site from Clickjacking Attack.
Implementation:
Ensure mod_headers.so is enabled in your httpd.conf
Go to $Web_Server/conf directory
Add following directive and save the httpd.conf
Header always append X-Frame-Options SAMEORIGIN
Restart apache
Verication:

Open Firefox and access your application

Check HTTP response headers in rebug, you should see X-Frame-Options as shown below.

4.3 Server Side Include

Server Side Include (SSI) has a risk in increasing load on the server. If you have shared environment and
heavy trac web applications you should consider disable SSI by adding Includes in Options directive. SSI
attack allows the exploitation of a web application by injecting scripts in HTML pages or executing codes
remotely.
Implementation:
Go to $Web_Server/conf directory
Open httpd.conf using vi
Search for Directory and add Includes in Options directive
<Directory /opt/apache/htdocs>
Options Indexes -Includes
Order allow,deny
Allow from all
</Directory>
Restart Apache
Note: if you have multiple Directory directives in your environment, you should consider doing the same
for all.

4.4 X-XSS Protection

Cross Site Scripting (XSS) protection can be bypassed in many browsers. You can force apply this
protection for web application if it was disabled by the user. This is used by majority of giant web
companies like Facebook, twitter, Google, etc.
Implementation:

Go to $Web_Server/conf directory
Open httpd.conf using vi and add following Header directive
Header set X-XSS-Protection 1; mode=block
Restart Apache
Verication:
Open Firefox and access your application
Check HTTP response headers in rebug, you should see XSS Protection is enabled and mode is
blocked.

4.5 Disable HTTP 1.0 Protocol

When we talk about security, we should protect as much we can. So why do we use older HTTP version of
protocol, lets disable them as well. HTTP 1.0 has security weakness related to session hijacking. We can
disable this by using mod_rewrite module.
Implementation:
Ensure to load mod_rewrite module in httpd.conf le
Enable RewriteEngine directive as following and add Rewrite condition to allow only HTTP 1.1
RewriteEngine On
RewriteCond %{THE_REQUEST} !HTTP/1.1$
RewriteRule .* - [F]

4.6 Timeout value conguration

By default Apache timed-out value is 300 seconds, which can be victim of Slow Loris attack and DoS. To
mitigate this you can lower the timeout value to maybe 60 seconds.
Implementation:
Go to $Web_Server/conf directory
Open httpd.conf using vi
Add following in httpd.conf
Timeout 60

SSL

Having SSL is additional layer of security you are adding into Web Application. However, default SSL
conguration leads to certain vulnerabilities and you should consider tweaking those congurations. We
require some tool to verify SSL settings. There are many available however, I would use SSL-Scan free tool.
You can download from http://sourceforge.net/projects/sslscan/

5.1 SSL Key

Breaching SSL key is hard, but not impossible. Its just matter of computational power and time. As you
might know using a 2009-era PC cracking away for around 73 days you can reverse engineer a 512-bit key.
So the higher key length you have, the more complex it becomes to break SSL key. Majority of giant Web
Companies use 2048 bit key, as below so why dont we?
Outlook.com
Microsoft.com
Live.com
Skype.com
Apple.com
Yahoo.com
Bing.com
Hotmail.com
Twitter.com
Implementation:
You can use openssl to generate CSR with 2048 bit as below.
Generate self-signed certicate
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout localhost.key -out

localhost.crt
Generate new CSR and private key
openssl req -out localhost.csr -new -newkey rsa:2048 -nodes -keyout
localhost.key
Add Personal Cert, Signer Cert and Key le in httpd-ssl.conf le under below directive
SSLCertificateFile # Personal Certificate
SSLCertificateKeyFile # Key File
SSLCACertificateFile # Signer Cert file
Verication:
Execute sslscan utility with following parameter. Change localhost to your actual domain name.
sslscan localhost | grep i key

As you can see current ssl key is 2048 bit, which is stronger.

5.2 SSL Cipher

SSL Cipher is an encryption algorithm, which is used as a key between two computers over the Internet.
Data encryption is the process of converting plain text into secret ciphered codes. Its based on your web
server SSL Cipher conguration the data encryption will take place. So its important to congure SSL
Cipher, which is stronger and not vulnerable. Lets validate the Cipher accepted in current SSL
conguration. We will use sslscan utility to validate as below command. Change localhost to your actual
domain name.
sslscan no-failed localhost

As you could see above, in current

conguration DHE, AES, EDH, RC4 cipher is accepted. Now if you are performing penetration test or PCI
compliance test, your report will say RC4 Cipher detected. Lately, it was found that RC4 is weak cipher and
to pass certain security test, you must not accept RC4 or any weak cipher. You should also ensure not to
accept any cipher, which is less than 128 bits.
Implementation:
Go to $Web_Server/conf/extra folder
Modify SSLCipherSuite directive in httpd-ssl.conf as below to reject RC4
SSLCipherSuite HIGH:!MEDIUM:!aNULL:!MD5:!RC4
Save the conguration le and restart apache server
Note: if you have many weak cipher in your SSL auditing report, you can easily reject them adding ! at
beginning. For ex to reject RC4: !RC4 Verication: Again, we will use sslscan utility to validate as below
command. Change localhost to your actual domain name.
sslscan no-failed localhost

So now we dont see RC4 anymore

as accepted Cipher. Its good to reject any low, medium, null or vulnerable cipher to keep yourself tension
free from getting attacked. You can also scan your domain against Qualys SSL Labs to check if you have
weak or vulnerable cipher in your environment.

5.3 Disable SSL v2

SSL v2 has many security aws and if you are working towards penetration test or PCI compliance then
you are expected to close security nding to disable SSL v2. Any SSL v2 communication may be vulnerable
to Man-in-The-Middle attack that could allow data tempering or disclosure. Lets implement apache web
server to accept only latest SSL v3 and reject SSL v2 connection request.
Implementation:
Go to $Web_Server/conf/extra folder
Modify SSLProtocol directive in httpd-ssl.conf as below to accept only SSL v3 and TLS v1
SSLProtocol ALL +SSLv3 +TLSv1
Verication:
Lets use sslscan utility to validate as below command. Change localhost to your actual domain name.

sslscan no-failed localhost

As you could see above, accepted

is only SSLv3 and TLSv1, which is safe from SSLv2 vulnerabilities.

Mod Security

Mod Security is an open-source Web Application Firewall, which you can use with Apache. It comes as a
module which you have to compile and install. If you cant aord commercial web application rewall, this
would be good choice to go for it. Mod Security says: In order to provide generic web applications
protection, the Core Rules use the following techniques:

HTTP Protection detecting violations of the HTTP protocol and a locally dened usage policy
Real-time Blacklist Lookups utilizes 3rd Party IP Reputation
Web-based Malware Detection identies malicious web content by check against the Google Safe
Browsing API.
HTTP Denial of Service Protections defense against HTTP Flooding and Slow HTTP DoS Attacks.
Common Web Attacks Protection detecting common web application security attack
Automation Detection Detecting bots, crawlers, scanners and other surface malicious activity
Integration with AV Scanning for File Uploads detects malicious les uploaded through the web
application.
Tracking Sensitive Data Tracks Credit Card usage and blocks leakages.
Trojan Protection Detecting access to Trojans horses.
Identication of Application Defects alerts on application miscongurations.
Error Detection and Hiding Disguising error messages sent by the server.

6.1 Download & Installation

Following prerequisites must be installed on server where you wish to use Mod Security with Apache. If any
one of these doesnt exist then Mod Security compilation will fail. You may use yum install on Linux or
Centos to install these packages.
apache 2.x or higher
libpcre package
libxml2 package
liblua package
libcurl package
libapr and libapr-util package
mod_unique_id module bundled with Apache web server
Now, lets download the latest stable version of Mod Security 2.7.5 from
http://www.modsecurity.org/download/
Transfer downloaded le to /opt/apache

Extract modsecurity-apache_2.7.5.tar.gz
# gunzip c modsecurity-apache_2.7.5.tar.gz | tar xvf
Go to extracted folder modsecurity-apache_2.7.5
# cd modsecurity-apache_2.7.5

Run the congure script including apxs path to existing Apache

# ./configure with-apxs=/opt/apache/bin/apxs
Compile & install with make script
# make
#make install
Once installation is done, you would see mod_security2.so in modules folder under /opt/apache as
shown below

Now this concludes,

you have installed Mod Security module in existing Apache web server.

6.2 Conguration
In order to use Mod security feature with Apache, we have to load mod security module in httpd.conf.
mod_unique_id module is pre-requisite for Mod Security. This module provides an environment variable
with a unique identier for each request, which is tracked and used by Mod Security.
Add following line to load module for Mod Security in httpd.conf and save the conguration le
LoadModule unique_id_module modules/mod_unique_id.so
LoadModule security2_module modules/mod_security2.so
Restart apache web server
Mod Security is now installed! Next thing you have to do is to install Mod Security core rule to take a full
advantage of its feature. Latest Core Rule can be downloaded from following link, which is free.
https://github.com/SpiderLabs/owasp-modsecurity-crs/zipball/master
Copy downloaded core rule zip to /opt/apache/conf folder
Unzip core rule le, you should see the extracted folder as shown below

You may wish to rename the folder to something short and easy to remember. In this example, I will
rename to crs.

Go to crs folder and rename modsecurity_crs10_setup.conf.example to

modsecurity_crs10_setup.conf

Now, lets enable these rules to get it working with Apache web server.
Add following in httpd.conf
<IfModule security2_module>
Include conf/crs/modsecurity_crs_10_setup.conf
Include conf/crs/base_rules/*.conf
</IfModule>
In above conguration, we are loading Mod Security main conguration le
modsecurity_crs_10_setup.conf and base rules base_rules/*.conf provided by Mod Security Core
Rules to protect web applications.
Restart apache web server
You have successfully congured Mod Security with Apache! Well done. Now, Apache Web server is
protected with Mod Security web application rewall.

6.3 Getting Started

Lets get it started with some of the important conguration in Mod Security to harden & secure web
applications. In this section, we will do all conguration modication in
/opt/apache/conf/crs/modsecurity_crs_10_setup.conf We will refer
/opt/apache/conf/crs/modsecurity_crs_10_setup.conf as setup.conf in this section for example
purpose. Its important to understand what are the OWASP rules are provided in free. There are two types
of rules provided by OWASP.
Base Rules these rules are heavily tested and probably false alarm ratio is less.
Experimental Rules these rules are for experimental purpose and you may have high false alarm. Its
important to congure, test and implement in UAT before using these in production environment.
Optional Rules these optional rules may not be suitable for the entire environment. Based on your
requirement you may use them. If you are looking for CSRF, User tracking, Session hijacking, etc.
protection then you may consider using optional rules. We have base, optional and experimental rules
after extracting downloaded crs zip le from OWASP download page. These rules conguration le is
available in crs/base_rules, crs/optional_rules and crs/experimental_rules folder. Lets get familiar with
some of the base rules.

modsecurity_crs_20_protocol_violations.conf:This rule is protecting from Protocol vulnerabilities

like response splitting, request smuggling, using non-allowed protocol (HTTP 1.0).
modsecurity_crs_21_protocol_anomalies.conf:This is to protect from request, which is missing with
Host, Accept, User-Agent in header.
modsecurity_crs_23_request_limits.conf:This rule has dependency on application specic like
request size, upload size, length of parameter, etc.
modsecurity_crs_30_http_policy.conf:This is to congure and protect allowed or disallowed method
like CONNECT, TRACE, PUT, DELETE, etc.
modsecurity_crs_35_bad_robots.conf:Detect malicious robots
modsecurity_crs_40_generic_attacks.conf:This is to protect from OS command injection, remote
le inclusion, etc.
modsecurity_crs_41_sql_injection_attacks.conf:This rule to protect SQL and blind SQL inject
request.
modsecurity_crs_41_xss_attacks.conf:Protection from Cross Site Scripting request.
modsecurity_crs_42_tight_security.conf:Directory traversal detection and protection.
modsecurity_crs_45_trojans.conf:This rule to detect generic le management output, uploading of
http backdoor page, known signature.
modsecurity_crs_47_common_exceptions.conf:This is used as an exception mechanism to remove
common false positives that may be encountered suck as Apache internal dummy connection, SSL
pinger, etc.

6.3.1

Logging

Logging is one of the rst things to congure so you can have logs created for what Mod Security is doing.
There are two types of logging available; Debug & Audit log.
Debug Log: this is to duplicate the Apache error, warning and notice messages from the error log.
Audit Log: this is to write the transaction logs that are marked by Mod Security rule Mod Security gives
you exibility to congure Audit, Debug or both logging. By default conguration will write both logs.
However, you can change based on your requirement. Log is controlled in SecDefaultAction directive. Lets
look at default logging conguration in setup.conf
SecDefaultAction phase:1,deny,log
To log Debug, Audit log use log To log only audit log use nolog,auditlog To log only debug log use
log,noauditlog You can specify the Audit Log location to be stored which is controlled by SecAuditLog
directive. Lets write audit log into /opt/apache/logs/modsec_audit.log by adding as shown below.
Implementation:
Add SecAuditLog directive in setup.conf and restart Apache Web Server

SecAuditLog /opt/apache/logs/modsec_audit.log
After restart, you should see modsec_audit.log getting generated as shown below.

6.3.2

Enable Rule Engine

By default Engine Rule is O that means if you dont enable Rule Engine you are not utilizing all the
advantages of Mod Security. Rule Engine enabling or disabling is controlled by SecRuleEngine directive.
Implementation:
Add SecRuleEngine directive in setup.conf and restart Apache Web Server
SecRuleEngine On
There are three values for SecRuleEngine:
On to enable Rule Engine
O to disable Rule Engine
DetectionOnly enable Rule Engine but never executes any actions like block, deny, drop, allow,
proxy or redirect
Once Rule Engine is on Mod Security is ready to protect with some of the common attack types.

6.3.3

Common Attack Type Protection

Now web server is ready to protect with common attack types like XSS, SQL Injection, Protocol Violation,
etc. as we have installed Core Rule and turned on Rule Engine. Lets test few of them.
XSS Attack:Open Firefox and access your application and put <script> tag at the end or URL as shown below
Monitor the modsec_audit.log in apache/logs folder

As you can see Mod Security blocks request as it contains <script> tag which is the root of XSS attack.
Directory Traversal Attack:- Directory traversal attacks can create lot of damage by taking advantage
of this vulnerabilities and access system related le. Ex /etc/passwd, .htaccess, etc.
Open Firefox and access your application with directory traversal
Monitor the modsec_audit.log in apache/logs folder
http://localhost/?../.../boot

As you can see Mod Security blocks request as it contains directory traversal.

6.3.4

Change Server Banner

Earlier in this guide, you learnt how to remove Apache and OS type, version help of ServerTokens
directive. Lets go one step ahead, how about keeping server name whatever you wish? Its possible with
SecServerSignature directive in Mod Security. You see its an interesting.
Note: in order to use Mod Security to manipulate Server Banner from header, you must set ServerTokesn
to Full in httpd.conf of Apache web server.
Implementation:
Add SecServerSignature directive with your desired server name in setup.conf and restart Apache Web
Server
SecServerSignature YourServerName
Ex:
[/opt/apache/conf/crs] #grep SecServer modsecurity_crs_10_setup.conf
SecServerSignature chandank.com
[/opt/apache/conf/crs] #
Verication:

Open Firefox and access your application

Check HTTP response headers in rebug, you should see Server banner is changed now as shown
below.

General Conguration

We will talk about some of the general conguration as best practice.

7.1 Congure Listen

When you have multiple interface and IPs on single server, its recommended to have Listen directive
congured with absolute IP and Port number. When you leave apache conguration to Listen on all IPs
with some port number, it may create problem in forwarding HTTP request to some other web server. This
is quite common in shared environment.
Implementation:
Congure Listen directive in httpd.conf with absolute IP and port as shown example below
Listen 10.10.10.1:80

7.2 Access Logging

Its essential to congure access log properly in your web server. Some of the important parameter to
capture in log would be the time taken to serve the request, SESSION ID. By default apache is not
congured to capture these data. You got to congure them manually as following.
Implementation:
To capture time taken to serve the request and SESSION ID in access log
Add %T & %sessionID in httpd.conf under LogFormat directive
LogFormat "%h %l %u %t "%{sessionID}C" "%r" %>s %b %T" common
You can refer http://httpd.apache.org/docs/2.2/mod/mod_log_cong.html for complete list of parameter
supported in LogFormat directive in Apache Web Server.

7.3 Disable Loading unwanted modules

If you have compiled and installed with all modules then there are high chances you will have many
modules loaded in Apache, which may not be required. Best practice is to congure Apache with required
modules in your web applications. Following modules are having security concerns and you might be
interested to disable in httpd.conf of Apache Web Server. WebDAV (Web-based Distributed Authoring and
Versioning) This module allows remote clients to manipulate les on the server and subject to various
denial-of-service attacks. To disable comment following in httpd.conf
#LoadModule dav_module modules/mod_dav.so
#LoadModule dav_fs_module modules/mod_dav_fs.so
#Include conf/extra/httpd-dav.conf
Info Module The mod_info module can leak sensitive information using .htaccess once this module is
loaded. To disable comment following in httpd.conf
#LoadModule info_module modules/mod_info.so
Reference: This wouldnt be possible without guidance from following link:
http://httpd.apache.org/docs/2.4/
http://www.modsecurity.org/documentation/
https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
I hope this practical guide has helped you in securing your Apache Web Server. If you liked this, please
help to share with your friends.